---
schema_version: "1"
id: 346c3abe709fb309bc570cf391186187c4dd680b47a8790c7986233589a09881
title: Tableau Server Key Management System
collection: tableau
version: current
locale: en-gb
portal_url: https://docs.salesforce.com/tableau/current/en-gb/server-linux/security_kms.md
canonical_url: https://help.tableau.com/current/server-linux/en-gb/security_kms.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 0f2d7e31163ba7c2050e50f415dce746045ef36718730762d0b06e97e892f6a2
description: Understand Key Management System (KMS) options for encryption at rest.
---
[Skip to main content](#main-content)

# Tableau Server Key Management System

Tableau Server has three Key Management System (KMS) options that allow you to enable encryption at rest. One is a local option that is available with all installations of Tableau Server. Two additional options require Advanced Management capabilities, but allow you to use a different KMS.

**Important:** As of 16 September 2024, Advanced Management is no longer available as an independent add-on option. Advanced Management capabilities are only available if you previously purchased Advanced Management, or if you purchased certain licence editions: Tableau Enterprise, Tableau Cloud+ or Tableau+ Bundle (available for Tableau Cloud), or Tableau Enterprise or Tableau Server+ (available for Tableau Server).

Beginning in version 2019.3, Tableau Server added these KMS options: 

- A local KMS that is available with all installations. This is described below.
- An AWS-based KMS that comes as part of Advanced Management. For details, see [AWS Key Management System](https://help.tableau.com/current/server-linux/en-gb/security_kms_aws.htm).

Beginning in version 2021.1, Tableau Server added another KMS option: 

- An Azure-based KMS that comes as part of Advanced Management. For details, see [Azure Key Vault](https://help.tableau.com/current/server-linux/en-gb/security_kms_azure.htm).

## Tableau Server local KMS

The Tableau Server local KMS uses the secret storage capability described in [Manage Server Secrets](https://help.tableau.com/current/server-linux/en-gb/security_secret_storage.htm) to encrypt and store the master extract key. In this scenario, the Java keystore serves as the root of the key hierarchy. The Java keystore is installed with Tableau Server. Access to the master key is managed by native file system authorisation mechanisms by the operating system. In the default configuration, the Tableau Server local KMS is used for encrypted extracts. The key hierarchy for local KMS and encrypted extracts is illustrated here:

![A diagram illustrating the process of encrypting data with multiple encryption keys.](/tableau/current/en-gb/server-linux/en-gb/Img/security_kms_local_key_hierarchy.png)

## Troubleshoot configuration

### Multi-node misconfiguration

In a multi-node setup for AWS KMS, the `tsm security kms status` command may report healthy (OK) status, even if another node in the cluster is misconfigured. The KMS status check only reports on the node where the Tableau Server Administration Controller process is running and does not report on the other nodes in the cluster. By default the Tableau Server Administration Controller process runs on the initial node in the cluster.

Therefore, if another node is misconfigured such that Tableau Server is unable to access the AWS CMK, those nodes may report Error states for various services, which will fail to start.

If some services fail to start after you have set KMS to the AWS mode, then run the following command to revert to local mode: `tsm security kms set-mode local`.

## Regenerate RMK and MEK on Tableau Server

To regenerate the root master key and the master encryption keys on Tableau Server, run the `[tsm security regenerate-internal-tokens](https://help.tableau.com/current/server-linux/en-gb/cli_security_tsm.htm#regenerate-tokens)` command.

## Other articles in this section